07c9a086dd9879641afc12b41f5fc556c0c871c41cf7bac1a014023c3ff10657

Analysis

user interaction
yes
max time kernel
20s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 17:07

Target
Cleaner.exe
Size 197KB
Sample260428-vm1yzsfy4p
SHA256 07c9a086dd9879641afc12b41f5fc556c0c871c41cf7bac1a014023c3ff10657
MD5 73b621f8d48b2ccc12baebf1878258ec
SHA1 15c902e9ab338188d791fa23992e52748348ff0f
SHA512 6e009a0a542fd6c905a2f22590f8f2843c85ae1b0c6de1fde8356037d55493dd25c8a63ef59a02c58e1006f7ff7a035104cffbe0a763d1e4eeb70962ad2af6b8
SSDEEP 3072:z4Ar5sgExdlGnDqwnInmB1+oh+1zz7AcgRegLdlbM:zvVsg4dlGnvnQmB1+Z137VgdLLo
TLSH
T1C714A431E1ADB0AAE157C075FD434D52A922F89D83647FE713914EF20B96EA09B7C2C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3632 set thread context of 3380	3632	Cleaner.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3632	Cleaner.exe
3632	Cleaner.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81
PID 3632 wrote to memory of 3380	3632	Cleaner.exe	81

C:\Users\Admin\AppData\Local\Temp\Cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\system32\winver.exe
  "C:\Windows\system32\winver.exe"
  2⤵
  PID:3380

memory/3380-1-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/3632-4-0x000001FCA3530000-0x000001FCA358D000-memory.dmp

Download